EUVD-2026-35558
GHSA-cm8c-qx86-hm82
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated low-privileged user to win a race condition and trigger a use-after-free, enabling code execution at kernel level. No public exploit identified at time of analysis, but AFD.sys has a long history of being a preferred LPE target and Microsoft has marked the issue as important. EPSS data was not provided in the source feed.
Technical ContextAI
AFD.sys is the kernel-mode driver that backs the Winsock user-mode API, brokering socket operations between user-space applications and the TCP/IP stack on every supported Windows release. The root cause is CWE-362 (concurrent execution using shared resource with improper synchronization, i.e. a race condition) that leads to a use-after-free: two threads racing on the same socket object can cause one path to free a structure while another still holds and dereferences a pointer to it. Because the dangling pointer is dereferenced in kernel context, controlling the freed allocation (via heap grooming of paged or non-paged pool) lets an attacker convert the UAF into arbitrary kernel read/write and ultimately SYSTEM-level execution.
RemediationAI
Patch available per vendor advisory - apply the Microsoft cumulative security update for your Windows build referenced on the MSRC page at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45598 as the primary fix; exact patched build numbers are listed only in that advisory and are not reproduced here to avoid inventing versions. Because exploitation requires local authenticated access, compensating controls until patching include restricting interactive and Remote Desktop logon rights on tier-0/tier-1 hosts (trade-off: blocks legitimate admin workflows), enforcing application allow-listing such as WDAC or AppLocker to stop unsigned LPE binaries from running (trade-off: high operational tuning cost), and enabling Microsoft Defender / EDR rules that flag suspicious AFD.sys IOCTL patterns and pool-spray behaviour (trade-off: detection-only, will not prevent fast exploits). Disabling AFD.sys itself is not a viable workaround because it would break all Winsock-based networking on the host.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-362 – Race Condition
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today